How Long to Keep Training Records

There is no single answer. Four different clocks apply depending on the rule: a fixed number of years, until the record is replaced, the length of someone's employment, or no period at all. Most rules that require training never say how long to keep the proof that it happened.

The Short Version

If you are here because someone asked how long you have to keep training records and you did not have an answer, here is the honest one.

• There is no single period. It changes rule by rule, and the differences are large.
• Most rules do not give a period at all. They tell you to make a record and keep it, then stop.
• The thirty year rule people quote is about something else. It covers exposure and medical records, not training records.
• OSHA is probably not the one who will ask you. The people who ask are your accreditor, your insurer, your customers and, if it ever comes to it, a lawyer.

The rest of this page explains each of those, with the citation so you can check it yourself.

The Thirty Year Rule Is About Something Else

Ask around and someone will tell you training records have to be kept for thirty years. That number is real. It sits in 29 CFR 1910.1020. It is also the wrong answer to the question.

1910.1020 covers two things: employee exposure records and employee medical records. Exposure records are the results of air monitoring and similar testing. Medical records are the health files that go with them. Those are what the thirty year clock is attached to.

A training record is a different thing. A sign-in sheet from a safety briefing is not a medical record. A quiz score is not an air monitoring result. The thirty year rule only touches a training record in the narrow case where that record is part of someone's medical or exposure file.

Four Different Clocks

Read enough of these rules next to each other and a pattern shows up. Retention periods are not all measured the same way. They run on four different kinds of clock, and which one you are on changes what your system has to be able to do.

1. A fixed number of years. The clock starts on a date and runs. Bloodborne pathogens training is the clearest case: three years from the date the training happened. You know the disposal date the day you create the record.

2. Until the next one replaces it. The record only has to last until a newer one exists. Respirator fit testing works this way. The current one matters. The old one does not.

3. For as long as the person works there. The clock is tied to the person, not to a date. It has no end until they leave, and then it ends straight away.

4. No period at all. The rule says make the record and keep it, and says nothing more. This is the most common case by a wide margin, and it is the one that causes problems.

Those four are not small differences in wording. They ask for different things from whoever holds the records. A fixed term can be automated. A replace-on-next rule needs the system to know which record supersedes which. An employment rule has to be wired into your leaver process. And a rule with no period cannot be automated at all until a human decides what the period should be and writes it down.

What the Rules Actually Say

These are the periods we were able to confirm, with the citation next to each one so you can check it rather than take our word for it.

Two of these catch people out

The HIPAA clock does not start when you think. Six years sounds simple. Read the wording again: from the date of creation, or the date it was last in effect, whichever is later. A training policy that stayed in force for four years does not begin its six years until you withdraw it. In practice that is a ten year record.

The fit test rule goes the other way. OSHA has said directly that the standard only requires fit test records to be kept until the next fit test is done, and that there are no extra retention requirements. Plenty of employers keep ten years of them. That is a choice. It is worth knowing which of your practices are choices.

A Mistake You Will See Almost Everywhere

While checking the periods above we kept running into the same error in published guidance, including on pages that rank well. It is worth naming, because if you copy it into your own schedule you will get the wrong answer.

People confuse how often you have to retrain with how long you have to keep the record. They are completely unrelated numbers.

Forklifts are the clearest example. 29 CFR 1910.178(l)(4)(iii) says each operator's performance has to be evaluated at least once every three years. That is a frequency. It tells you when to look at the operator again. It says nothing about paperwork.

The record itself is dealt with separately, in 1910.178(l)(6). That paragraph lists what the certification has to contain, which is the operator's name, the training date, the evaluation date and who did the training or evaluation. It does not say how long to keep it.

Who Is Actually Going to Ask You

This is the part that changes how you should think about the whole question, and almost nobody writing about training records mentions it.

Most people assume they keep records in case OSHA turns up. The law is less helpful to OSHA than that assumption suggests.

The six month limit

Section 9(c) of the Occupational Safety and Health Act says no citation may be issued after six months following the occurrence of a violation. Six months, not six years.

OSHA spent years arguing that a missing record was a continuing violation, so the six months restarted every day the gap stayed open. In 2012 the D.C. Circuit rejected that in AKM LLC doing business as Volks Constructors v. Secretary of Labor. The court held that failing to keep records through the retention period is not a continuing violation, read the word occurrence to mean a specific past event, and threw the citations out.

But there is a limit to the limit

The same court was careful about scope. It said a continuing violation argument may still work where the danger itself is ongoing, and gave untrained employees sent into dangerous situations as its own example.

That gives you a clean way to think about your exposure:

• A record you failed to create four years ago is, on the D.C. Circuit's reasoning, a past event. The clock on it ran out long ago.
• A worker who is untrained today is a present condition. That is citable today, and no retention schedule protects you from it.

So the reason to keep training records for years is not really OSHA. It is everyone else:

• Your accreditor or licensing body. These periods are usually longer than anything in federal law, and they are contractual, which means you agreed to them. Continuing education bodies commonly expect five to seven years.
• State law. Several states set their own periods for specific training. Our piece on workplace violence training laws covers six of them, and two set an explicit period where the federal rule sets none.
• Your insurer and your customers. Both ask for training evidence, and both tend to look back further than a regulator would.
• A plaintiff's lawyer. In an injury claim the question is whether this person was trained before it happened. If you cannot show it, the absence does the arguing for them.

What a Record Has to Contain

Length is only half the problem. A record kept for ten years is worth nothing if it does not hold the right information. An auditor is really testing whether it can answer five questions.

1. Who was trained. A named person. Not a headcount, not a department. Unreadable signatures on a sign-in sheet are the most common failure here.

2. What they were trained on. Enough detail to show it covered what the rule asks for. A course title is often not enough. Keep the version of the material you actually used.

3. When it happened. The date. Every fixed term runs from it. If you cannot date it you cannot defend it.

4. Who delivered it. The trainer's name, and where the rule asks for competence, their qualification to deliver it.

5. How you know they completed it. Attendance is not completion. Where the rule asks for understanding rather than exposure, you need the assessment result as well as the attendance mark.

The fifth one is where most teams are weakest, and it is where a spreadsheet runs out. A spreadsheet can record that someone attended. It usually cannot prove what they were shown, which version of it, or that they demonstrated they understood it.

If you are still doing this by hand, our guide to training tracking methods and a free matrix covers what a manual system can do before it breaks.

How to Build a Schedule You Can Defend

You cannot avoid making a decision here. The rules will not make it for you. What you can do is decide deliberately, write down why, and apply it the same way every time. That is most of what defensible means.

1. List every training obligation you are under. Federal, state, accreditor, insurer, customer contract. Our overview of OSHA training requirements is a reasonable start for the federal safety side.

2. For each one, find the period or confirm there is none. Write the citation beside it. Read the recordkeeping paragraph, not the training paragraph. This is the work, and it is worth doing once properly.

3. Where nothing is stated, pick a period and record your reason. The reason matters more than the number. Six years is a common default because it covers most contract limitation periods. A documented three years beats an undocumented ten.

4. Follow the longest period that applies. If the federal rule says three years and your accreditor says seven, you keep it seven. The schedule follows the strictest master.

5. Decide what happens at the end. A schedule that never deletes anything is a storage habit, not a retention policy. Privacy law expects disposal to be deliberate.

6. Make the system do it. Anything that relies on a person remembering to check a folder will fail quietly, and you will find out during an audit.

What this means for the system holding your records

Retention gets designed last and matters longest. The practical test for any system is whether it can do four things: apply a different rule to different record types, keep the version of the material you actually delivered, store the assessment result next to the attendance mark, and produce all of it for one named person over a date range without turning it into a project.

That last one is where most systems fail. MyPass LMS builds audit reporting around it: pull every record for a person, a course or a period, with the completion evidence attached, as one export instead of a reconstruction. The Community Edition is free and self-hosted, so the records sit on infrastructure you control and retention stays your decision.

Where These Figures Come From

Each period in the table comes with its citation. Most were taken from the regulation text or from OSHA's own published interpretations. A small number, including the bloodborne pathogens period, were confirmed against federal training material and specialist sources that quote the paragraph directly rather than from the CFR text itself, so the citation is given for you to verify.

We have not tried to produce a complete list of every training rule in American law. No such list exists, and anything claiming to be one deserves a careful read. What is here is a checked sample, chosen to show the four kinds of clock, because that is the part that changes how you build your schedule.

Where a rule gives no period, we have said so rather than filling the gap with a number. That gap is the finding, not an omission.

Everything here was read on 4 November 2026. Rules change and interpretations change, so check the current text rather than trusting this page a year from now.

The bottom line

The honest answer to how long you should keep training records is that it depends which rule you are under, and most rules do not say.

That sounds unhelpful, but it tells you exactly where the work is. The work is not hunting for one number. It is listing your obligations, writing a period against each with the reason beside it, and making a system apply it so nobody has to remember.

Do that once and the question stops being frightening. Someone asks for proof, you produce it, and the conversation moves on.

Frequently asked questions

How long do you have to keep OSHA training records?

It depends on the standard. Bloodborne pathogens training records are kept three years from the date of training. Respirator fit test records only until the next fit test. Many OSHA standards require a record but give no period at all.

Is there a thirty year rule for training records?

No. The thirty year period in 29 CFR 1910.1020 covers employee exposure records and medical records. It reaches a training record only if that record is part of a medical or exposure file.

Does forklift certification have to be kept for three years?

No. The three year interval in 1910.178(l)(4)(iii) is how often an operator must be evaluated. The certification paragraph, 1910.178(l)(6), sets no retention period.

How long should we keep records when no rule gives a period?

Pick a period and write down the reason. Six years is a common default because it covers most contract limitation periods. A documented shorter period is easier to defend than an undocumented long one.

Sources

• 29 CFR 1910.1020(d)(1), access to employee exposure and medical records. The thirty year period applies to employee exposure records and employee medical records. Checked against the NIOSH compliance checklist for the standard, publication 2004-101.
• 29 CFR 1910.1030(h)(2)(ii), bloodborne pathogens. Training records kept three years from the date on which the training occurred.
• 29 CFR 1910.134(m)(2)(ii), respiratory protection. An OSHA standard interpretation letter dated 2 June 2009 states the standard only requires fit test records to be retained until the next fit test is administered, and that there are no additional retention requirements.
• 29 CFR 1910.178(l)(4)(iii) and (l)(6), powered industrial trucks. The three year interval is an evaluation frequency. The certification paragraph lists what the record must contain and sets no retention period.
• OSHA publication 2254, Training Requirements in OSHA Standards, read for any retention period attached to a training record. 29 CFR 1910.66(i)(1)(v) requires the certification record to be kept for the duration of the employee's employment. 29 CFR 1910.119(g)(3) and 29 CFR 1910.120(p)(8) and (q)(8) require a record and set no period.
• Section 9(c) of the Occupational Safety and Health Act: no citation may be issued after the expiration of six months following the occurrence of any violation.
• AKM LLC doing business as Volks Constructors v. Secretary of Labor, United States Court of Appeals for the District of Columbia Circuit, decided 6 April 2012. The court held that failing to keep records through the retention period is not a continuing violation, and vacated the citations. It noted that a continuing violation theory may still apply to ongoing hazards, giving untrained employees sent into dangerous situations as an example.
• 45 CFR 164.530(j)(2), HIPAA administrative requirements. Documentation required under paragraph (j)(1) is kept for six years from the date of its creation or the date when it last was in effect, whichever is later.
• Read on 4 November 2026. Federal rules change and state rules sit on top of them. Check the current text before you rely on a period.
• This explains what published rules say. It is not legal advice, and your retention schedule should be signed off by someone who can give it.